# Architecture

NexaFabric is split into five layers:

1. Frontend: React application for daily network, IPAM, policy, and audit operations.
2. API: FastAPI REST surface with OpenAPI docs, JWT auth, RBAC hooks, and validation.
3. Domain services: provider registry, policy engine, firewall orchestrator, audit service, and job coordination.
4. Persistence: PostgreSQL through SQLAlchemy models. Alembic is intended for production migrations.
5. Workers: background execution for sync, compile, drift detection, IPAM scans, cleanup, and backup export.

Provider interfaces are intentionally separated into `HypervisorProvider`, `InventoryProvider`, `NetworkProvider`, and `FirewallProvider`. The first implementation is Proxmox, but the API layer is not tied directly to Proxmox-specific code.

Firewall orchestration follows this flow:

1. Policy definition is compiled.
2. Conflicts and broad access warnings are calculated.
3. Provider-specific preview output is produced.
4. Audit log records the preview.
5. A later apply path must verify cluster write mode, acquire a lock, and write a second audit record.